Next, we derive a lower bound of the adversarial label probability \(p_i^\ast \)  (\(i \in L(\mathbf {x})\) ) as an example to illustrate our main idea. Our derivation of the upper bound of the adversarial label probability for a label in \(\lbrace 1, 2, \cdots , c\rbrace \setminus L(\mathbf {x})\)  follows a similar procedure.
Given a label \(i \in L(\mathbf {x})\) , we can find a region \(\mathcal {A}_i\)  via our variant of Neyman-Pearson Lemma [1]} such that \(\text{Pr}(\mathbf {X} \in \mathcal {A}_i) = \underline{p_i}\) . Then, we can derive a lower bound of \(p^*_i\)  via computing the probability of the random variable \(\mathbf {Y}\)  in the region \(\mathcal {A}_i\) , i.e., we have:
\(p^*_i \ge \text{Pr}(\mathbf {Y} \in \mathcal {A}_i).\) 
